PT-2024-7726 · Linux+3 · Linux Kernel+3
Published
2024-02-19
·
Updated
2024-10-31
·
CVE-2024-26745
CVSS v2.0
4.6
Medium
| Vector | AV:L/AC:L/Au:S/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.4.0
Description
The Linux kernel has a vulnerability in the powerpc/pseries/iommu component. When the kdump kernel tries to copy dump data over SR-IOV, the LPAR panics due to a NULL pointer exception. The kernel attempted to read a user page, which is considered an exploit attempt. The vulnerability occurs because the IOMMU table is not initialized for kdump over SR-IOV.
The issue arises when Dynamic DMA Windows (DDWs) are scanned and added to the Flattened Device Tree (FDT) before kexec hands over control to the kdump kernel. For the SR-IOV case, the default DMA window "ibm,dma-window" is removed from the FDT, and the DDW is added for the device. Later, when the device driver tries to enter TCEs for the SR-IOV device, a NULL pointer exception is thrown from iommu area alloc().
The fix is to initialize the IOMMU table with the DDW property stored in the FDT. There are two points to remember:
- For the dedicated adapter, the kdump kernel would encounter both default and DDW in the FDT, and the DDW property is used to initialize the IOMMU table.
- A DDW could be direct or dynamic mapped, and the kdump kernel would initialize the IOMMU table and mark the existing DDW as "dynamic".
Recommendations
To resolve the issue, update the Linux kernel to version 6.4.0 or later. If updating is not possible, consider disabling the SR-IOV feature or restricting access to the vulnerable IOMMU table until a patch is available.
Exploit
Fix
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Astra Linux
Linux Kernel
Red Os
Suse